Security

Short-lived tokens, no key files, exact audiences.

• No service-account key files. Impersonate or use Workload Identity. A downloaded JSON key is a security incident, not a convenience.
• Exact audience. Token aud must match the environment host URL with no trailing slash and no run.app alias.
• Authorization only. X-Serverless-Authorization is rejected so a platform identity cannot silently replace application identity.
• Registered principals only. A valid Google token is insufficient until the subject is in the principal registry and enabled.
• Docs password ≠ API auth. Rotate the docs password operationally outside this repository. It never authorizes a data request.
• No production in the API client. Production keeps Cloud Run invoker IAM. Do not add production as a server in these docs.
• Redact secrets in logs. Never log the bearer token, identity-token CLI output, or financial response bodies.
• CORS is UAT-only and exact-origin: https://docs.modulate-api.es.flute.com and http://localhost:3000. Production disables CORS.